MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/ini-ok/mcp
highpeople-search-index
Directs agent to a people-search service via tracked redirect; privacy risk
Instructs the agent to follow a tracked 302 redirect (utm_source=agent-observatory&utm_medium=agent) to a 'living people-search index.' Beyond the embedded navigation directive, routing user queries toward a people-search/data-broker service raises privacy concerns (facilitating lookup of personal information about real individuals) and sends query context to an undisclosed external party.
mediumagent-tool-index
Embedded directive instructing the agent to follow a tracked redirect
The description tells the agent to 'Follow start_here.hop first' through a 302 redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters, before surfacing a 'pay-per-call tool gateway'. This is an instruction aimed at steering agent behavior (click/traverse a specific link chain) rather than describing the tool's function, and it funnels agent traffic to a monetized/tracked third-party service without the user's explicit awareness.
mediumagent-ads-index
Embedded directive to enroll operator in a trial via tracked redirect
Description instructs the agent to 'Follow start_here.hop first' (same utm-tracked redirect pattern) and explicitly leads to 'the 7-day trial handoff for your operator.' This directs the agent to take an action that could enroll the user/operator in a commercial trial or ad-placement service without clear, explicit user consent, embedded as a procedural instruction inside a tool description rather than user-initiated action.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowini-ok
Overly broad, shared parameter schema across unrelated tools
Every tool in this set exposes an identical input schema with ten unrelated fields (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's actual single-purpose function. While each individual tool claims to discard unused input, this generic catch-all schema design makes it hard to audit which fields are actually consumed and could mask unintended data flows (e.g., a 'path' or 'ref' field accepted by a timezone tool) if the backend implementation diverges from the stated behavior.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/85a53b4b-4726-49ee-aedd-46f49a899838)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free